Security Management Device

Abstract

To make it possible to perform communication with high safety even for communication between terminal devices connected via a switching hub.SOLUTION: A DHCP function unit 130 assigns an IP address of the same segment to each of subordinate terminal devices connected to its own device. A monitoring terminal identifying unit 140 identifies a terminal device to be monitored among the terminal devices connected to the own device, based on an output signal from a security function unit 120. The DHCP function unit 130 assigns an IP address of a segment different from that of the other terminal devices to the terminal device identified by the monitoring terminal identifying unit 140.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a device that performs security management, such as a UTM (Unified Threat Management) device. [Background technology]

[0002] UTM devices (unified threat management devices), which integrate a number of different security functions into a single piece of hardware and perform centralized security management for networks, etc., are becoming more widely used in companies, etc. Various improvements have been made to UTM devices. For example, Patent Document 1, which will be described later, discloses a technology for a UTM device that dynamically switches virus detection methods depending on the access destination, the category of content provided by the access destination, the file type of the content, etc. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-092755 A Summary of the Invention [Problem to be solved by the invention]

[0004] As mentioned above, various improvements have been made to UTM devices, realizing highly reliable security functions. UTM devices are installed between a WAN (Wide Area Network), which is mainly the Internet, and a LAN (Local Area Network), and can monitor, control, and manage communications between the WAN and LAN. However, the UTM device cannot be involved in communications between subordinate terminal devices connected to the UTM device via, for example, a switching hub.

[0005] The UTM device has a DHCP (Dynamic Host Configuration Protocol) server function, and assigns IP addresses with the same segment (network section) to subordinate terminal devices connected to the device via, for example, a switching hub. Also, the switching hub can distribute data based on MAC (Media Access Control) addresses for communications between terminal devices with IP addresses connected to the device. Therefore, communications between terminal devices with the same segment connected to the switching hub (communications between terminal devices under the UTM device) are established via the switching hub and do not pass through the UTM device.

[0006] In this way, communications between terminal devices connected to a UTM device via a switching hub are identified by MAC addresses, so there is no need to identify the destination by IP address and the communications do not go through the UTM device. Therefore, the UTM device cannot detect problems that occur within a LAN formed by connecting terminal devices to the UTM device via a switching hub. In this case, security measures rely on the security functions of the terminal devices, such as antivirus software installed in the terminal devices.

[0007] In view of the above, the present invention relates to a security management device such as a UTM device, and aims to enable highly secure communication by appropriately intervening in communications between terminal devices connected to the device via a hub device. [Means for solving the problem]

[0008] In order to solve the above problems, the security management device of the invention described in claim 1 comprises: A security management device that realizes a security function regarding communication between different segments, address assignment means for assigning an IP (Internet Protocol) address of the same segment to each of the subordinate terminal devices; A security means for realizing a security function; a specifying means for specifying, based on an output signal from the security means, a terminal device to be monitored among the subordinate terminal devices; Equipped with The address assignment means assigns, to the terminal device identified by the identification means, an IP address in a segment different from that of other terminal devices under the control of the terminal device. It is something like When the address assignment means assigns an IP address to the terminal device identified by the identification means, the address assignment means additionally assigns to itself an IP address of the same segment as the IP address assigned to the identified terminal device. It is characterized by:

[0009] According to the security management device of the invention described in claim 1, the address assignment means assigns an IP (Internet Protocol) address of the same segment to each of the subordinate terminal devices. The security means realizes the security function, and based on an output signal from the security means, the identification means identifies the subordinate terminal devices that should be monitored. The address assignment means assigns an IP address of a segment different from that of the other subordinate terminal devices to the terminal device identified by the identification means. Furthermore, when an IP address is assigned to the terminal device identified by the identification means, the address assignment means additionally assigns to the own device an IP address in the same segment as the IP address to be assigned to the identified terminal device. Effect of the Invention

[0010] According to the security management device of the present invention, it is possible to assign an IP address of a segment different from the segment of the IP addresses assigned to other subordinate mobile terminals to a mobile terminal that is a monitoring target. In this way, it is possible to utilize the function of a hub that transmits to a default gateway for communication with a terminal device having an IP address of a segment different from the IP address assigned to the terminal device connected to the device itself. This allows the security management device that functions as a default gateway to be appropriately involved in communication between subordinate terminal devices, making it possible to carry out communication with high security. [Brief description of the drawings]

[0011] [Figure 1]1 is a diagram for explaining an example of a system environment in which a UTM device according to an embodiment is used; [Diagram 2] 1A to 1C are diagrams for explaining an example of IP address assignment by a UTM device according to an embodiment and an example of intra-LAN communication after assignment. [Diagram 3] 1A to 1C are diagrams illustrating an example of IP address reassignment performed by a UTM device according to an embodiment, and an example of communication within a LAN after reassignment. [Figure 4] FIG. 2 is a block diagram illustrating a configuration example of a UTM device according to an embodiment. [Diagram 5] 10 is a diagram for explaining an example of IP address assignment when the UTM device of the embodiment has multiple LAN ports; [Figure 6] 11 is a diagram illustrating an example of reassignment of an IP address when the UTM device according to the embodiment has multiple LAN ports. FIG. [Figure 7] 2 is a diagram for explaining an example of a management mode of IP addresses in a UTM device according to an embodiment; FIG. [Figure 8] 4 is a sequence diagram for explaining processing performed by a UTM device according to an embodiment. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the security management device of the present invention will be described with reference to the drawings. In the embodiment described below, an embodiment of the security management device according to the present invention will be described by taking as an example a case where it is applied to a UTM device. In this specification, the term "security" generally refers to protecting data, systems, communication paths, etc. using encryption technology, defense software, access restriction technology, etc., and eliminating the risk of confidential information leaks, external attacks, information tampering, etc. Therefore, the term "security function" refers to a function for protecting data, systems, communication paths, etc. using encryption technology, defense software, access restriction technology, etc., and eliminating the risk of confidential information leaks, external attacks, information tampering, etc.

[0013] [System environment in which UTM device is used] 1 is a diagram for explaining an example of a system environment in which a UTM device 1 according to an embodiment is used. The UTM device 1 is a comprehensive threat management device configured by mounting a plurality of different security functions on a single piece of hardware, and is an embodiment of a security management device according to the present invention.

[0014] A LAN 4 is formed by connecting a plurality of terminal devices, namely, PCs (Personal Computers) 3(1), 3(2), 3(3), 3(4), ..., to the UTM device 1 via a switching hub (hereinafter referred to as SW hub) 2. In this manner, a security monitoring system is formed by the UTM device 1, the SW hub 2, and the PCs 3(1), 3(2), 3(3), 3(4), ... connected to the SW hub 2. The security monitoring system is formed, for example, within a company, and each of the PCs 3(1), 3(2), 3(3), 3(4), ... is a business PC used by an employee.

[0015] As shown in Fig. 1, the UTM device 1 is connected to the Internet 5. On the Internet 5, there exist a large number of HTTP (Hypertext Transfer Protocol) server devices 6 and a large number of mail server devices 7. Various web pages stored in the HTTP server device 6 are available to an unspecified number of people. The HTTP server device 6 is also called a web server, etc. In addition, by using the mail server device 7, it is possible to send and receive e-mail via the Internet 5.

[0016] Therefore, each of PCs 3(1), 3(2), 3(3), 3(4), ... connected to LAN 4 can access HTTP server device 6 on Internet 5 through UTM device 1 and view the desired Web page. Also, each of PCs 3(1), 3(2), 3(3), 3(4), ... connected to LAN 4 can use mail server device 7 on Internet 5 through UTM device 1 to send and receive e-mail to and from the desired recipient. Note that mail server device 7 actually includes a sending server device, a receiving server device, a DNS (Domain Name System) server device, etc.

[0017] In this way, each of the terminal devices PC3(1), 3(2), 3(3), 3(4), ... connected to the LAN 4 always communicates via the UTM device 1 when using the Internet 5. This makes it possible to use a number of different security functions provided in the UTM device 1, ensuring a high level of safety when using the Internet 5. The UTM device 1 also has a function of assigning IP addresses (private IP addresses) to terminal devices that communicate with its subordinate PCs, etc. In other words, the UTM device 1 has a DHCP (Dynamic Host Configuration Protocol) function.

[0018] An IP address, expressed in decimal, consists of four parts, for example "192.168.128.10". In this embodiment, we consider the case where the so-called subnet mask is "255.255.255.0". In this example, the first three parts separated by "." (periods), "192.168.128", are the network part, also known as a segment, which indicates the network to which the address belongs. In this example, the fourth and final part, "10", is the host part, which indicates an individual terminal device.

[0019] The DHCP server function of the UTM device 1 basically assigns IP addresses of the same segment to subordinate terminal devices connected to the device itself. However, the UTM device 1 of this embodiment has multiple LAN ports, and although it assigns IP addresses of the same segment to terminal devices connected to the same LAN port, it is possible to assign IP addresses of different segments to each LAN port.

[0020] Fig. 2 shows the security management system part shown in Fig. 1, and is a diagram for explaining an example of IP address assignment by the UTM device 1 and an example of intra-LAN communication after assignment. In the example shown in Fig. 2, each of PC3(1), PC3(2), PC3(3), PC3(4), ... is assigned an IP address with a segment (network part) of "192.168.1" by the UTM device 1. In this way, when communication is performed between PCs constituting LAN4, such as communication between PC3(2) and PC3(3) shown by the dotted arrow in Fig. 2, the communication destination can be identified by the MAC address by the function of the SW hub 2, and communication can be performed without going through the UTM device 1.

[0021] The SW hub 2 is a commercially available general switching hub, and for communication between terminal devices (PCs) with the same IP address segment connected through the SW hub 2, the SW hub 2 can identify the destination based on the MAC address and distribute the transmitted data. As shown in Figs. 1 and 2, a LAN is formed starting from the SW hub 2, and communication within the same LAN is safer than communication through a WAN, which is mainly the Internet 5, so it is appropriate to enable communication without going through the UTM device 1. This prevents an increase in communication traffic through the UTM device 1 and enables efficient communication. Note that the WAN has been described as being mainly the Internet 5, but it means an external network as seen from the UTM device 1. For this reason, the WAN also includes the Internet 5 and the LAN of the other party connected to the Internet 5.

[0022] However, each of PCs 3(1), 3(2), 3(3), 3(4), ... connected to SW hub 2 can connect to a WAN, which is mainly the Internet 5, via UTM device 1, and there is a non-zero risk of infection with a computer virus. For this reason, PCs 3(1), 3(2), 3(3), 3(4), ... may become infected with a computer virus, causing problems such as the following. For example, they may start to communicate a large amount of data over the WAN, receive a large amount of spam mail, or frequently try to access web pages that are considered high risk by the web filtering function. Such conditions can be detected by the security function of UTM device 1.

[0023] In addition, PC3(1), 3(2), 3(3), 3(4), ... connected to LAN4 may be taken out and then reconnected to LAN4. In addition, external memory such as USB (Universal Serial Bus) memory may be used in PC3(1), 3(2), 3(3), 3(4), ... connected to LAN4. In such a case, the risk of being infected with a computer virus may also be high. In addition, security software installed in PC3(1), 3(2), 3(3), 3(4), ... connected to LAN4 may detect an abnormality. In this way, the occurrence of an event such as reconnection to LAN4, use of external memory, or detection of an abnormality by security software may be notified (declared) to the UTM device 1 by PC3(1), 3(2), 3(3), 3(4), ..., and the UTM device 1 may grasp it.

[0024] Now, let us assume that the UTM device 1 detects (understands) the occurrence of an event such as the occurrence of a large volume of communication on the WAN, the receipt of a large volume of spam mail, frequent access to high-risk web pages, reconnection to LAN4, use of external memory, or detection of an abnormality by security software. In this case, the UTM device 1 identifies the PC from which the event occurred, and reassigns to the identified PC an IP address of a segment (network portion) different from the currently assigned IP address.

[0025] FIG. 3 is a diagram for explaining an example of reassignment of an IP address performed by the UTM device 1 and an example of communication within the LAN after reassignment. FIG. 3 also shows the security management system part shown in FIG. 1, as in FIG. 2. As explained with reference to FIG. 2, IP addresses of the same segment are assigned to PC3(1), 3(2), 3(3), 3(4), ... connected to LAN4. In this case, for example, assume that at least one of the above-mentioned predetermined events occurs for PC3(2). That is, assume that one of the events occurs, such as occurrence of a large amount of communication to the WAN, receipt of a large amount of spam mail, frequent access to a high-risk web page, reconnection to LAN4, use of an external memory, or detection of an abnormality by security software of a terminal device (PC).

[0026] The UTM device 1, which detects the occurrence of the event for PC3(2), uses its own DHCP function to reassign to the identified PC3(2) an IP address of a different segment (network portion) from the currently assigned IP address. In the example shown in Fig. 3, the IP address "192.168.1.3" was originally assigned to PC(2), but the example shows a case where the IP address "192.168.2.2" of a different segment is reassigned. The UTM device 1 also additionally assigns to itself the IP address "192.168.2.1" of the same segment as the IP address reassigned to PC(2), thereby making the UTM device 1 the default gateway (hereinafter referred to as default GW) for PC3(2).

[0027] As a result, as shown by the dotted arrows in Figure 3, even when communication is performed between PCs constituting LAN4, communication between PC3(2) and PC3(3) having IP addresses in different segments is communication via the UTM device 1. As described above, for communication between terminal devices connected through the SW hub 2 and assigned IP addresses, the SW hub 2 identifies the destination based on the MAC address and distributes the transmitted data. However, for communication between terminal devices assigned IP addresses in different segments, the SW hub 2 sends the communication data to the default GW. In this case, communication is communication via the UTM device 1 even for communication between subordinate terminal devices connected to the SW hub 2.

[0028] 3, communication between PC3(2) where the above-mentioned predetermined event has occurred and normal PC3(3) can be performed via the UTM device 1, even between PCs connected to the LAN4. In this case, it becomes possible to utilize the security function of the UTM device 1, and communication between PCs connected to the LAN4 can be performed more securely. Note that such communication via the UTM device 1 is not only communication with PC3(2) where the predetermined event has occurred as the sender (originator), but also communication with PC3(2) as the destination (recipient) of the transmission. This is because the IP address segments are different.

[0029] 3, communications between PC3(1), PC3(3), PC3(4), ... to which IP addresses have not been reassigned can be distributed by the SW hub 2 functioning to distribute communication destinations without going through the UTM device 1 as in the past. Therefore, there is no need to increase communication traffic via the UTM device 1 more than necessary. A specific configuration example of the UTM device 1 in this embodiment will be described below.

[0030] [Example of UTM device 1 configuration] 4 is a block diagram for explaining a configuration example of the UTM device 1. The connection terminal 101 constitutes a connection end to the Internet 5. The communication I / F 102 converts data transmitted to the device itself via the Internet 5 into data in a format that can be processed by the device itself and imports the data. The communication I / F 102 also converts data to be transmitted from the device itself into data in a transmission format and transmits the data to a target destination via the Internet 5. Therefore, communication with a server device or the like connected to the Internet 5 is performed via the connection terminal 101 and the communication I / F 102.

[0031] Although not shown, the control unit 103 is configured by connecting a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and a non-volatile memory via a bus, and realizes a function of controlling each part of the UTM device 1. The storage device 104 is a device part consisting of a recording medium such as an SSD (Solid State Drive) and its driver, and performs recording, reading, changing, deleting, etc. of various data on the recording medium. The storage device 104 stores and holds necessary data and programs, and is also used as a working area for temporarily storing intermediate data generated in various processes. In this embodiment, the storage device 104 has a host address management file 104A for managing IP addresses assigned to the host device and a terminal address management file 104B for managing IP addresses assigned to subordinate terminal devices connected to the host device. Details of these files will be described later.

[0032] The clock circuit 105 can provide the current date, the current day of the week, and the current time, and can also realize a timer function for measuring a predetermined time range. The clock circuit 105 is used, for example, to measure the time since communication with a predetermined destination is started, or the time since a predetermined web page is accessed, etc. It is also used to measure the unit time when measuring the communication volume per unit time.

[0033] The LAN connection terminals 111, 113, 115, and 117 constitute connection ends to the LAN. The LAN ports 112, 114, 116, and 118 convert data sent from subordinate terminal devices to the device itself through the LAN into data in a format that can be processed by the device itself and import the data. The LAN ports 112, 114, 116, and 118 also convert data to be sent from the device itself to subordinate terminal devices into data in a format for sending, and send the data to the target terminal device through the LAN. Therefore, communication with subordinate terminal devices connected to the LAN is performed through the LAN connection terminals 111, 113, 115, and 117 and the LAN ports 112, 114, 116, and 118.

[0034] 4, P2P countermeasure unit 121, HP access control unit 122, virus countermeasure unit 123, e-mail countermeasure unit 124, IPS / IDS unit 125, firewall unit 126, and terminal linkage unit 127 constitute security function unit 120. P2P countermeasure unit 121 realizes a function of prohibiting P2P connections with parties that do not implement security measures or with malicious parties. Note that "P2P" stands for "Peer to Peer," and refers to direct communication between equal parties via the Internet. The function of P2P countermeasure unit 121 realizes a function of preventing, for example, one-to-one file exchanges of images and the like with problematic parties, and preventing virus infection from the other party.

[0035] The HP (Home Page) access control unit 122, for example, realizes a function of selecting a desired homepage category in advance and prohibiting access to homepages that fall under that category. For example, URL filtering to inappropriate sites such as gambling sites, adult sites, and drug-related sites is possible. The virus protection unit 123 verifies the response of a Web page (virus checks). Specifically, the virus protection unit 123 realizes a function of monitoring communications when browsing a Web page and verifying (checking) whether images to be viewed or files to be downloaded contain viruses.

[0036] The mail countermeasure unit 124 realizes a function of blocking received e-mails with unwanted advertisements or virus attachments. The IPS / IDS unit 125 realizes a function of preventing inappropriate intrusions and notifying inappropriate intrusions. Here, IPS is an abbreviation for Intrusion Prevention System, and IDS is an abbreviation for Intrusion Detection System. The IPS / IDS unit 125 can defend against attacks by so-called malware such as worms and Trojan horses.

[0037] The firewall unit 126 determines whether to supply data to a LAN (internal company network) based on the state of data communication, the software used, etc., and realizes the function of protecting the system from attacks and unauthorized access from an external network. The terminal linking unit 127 monitors information from terminal devices connected through the LAN connection terminals 111, 113, 115, 117 and the LAN ports 112, 114, 116, 118, and detects the occurrence of a predetermined event related to the terminal device. As described above, the predetermined event related to the terminal device is reconnection to the LAN, use of an external memory, detection of an abnormality by security software of the terminal device, etc. In this way, the UTM device 1 can comprehensively deal with threats occurring in the communication environment by mounting a plurality of different security functions in one piece of hardware.

[0038] The DHCP function unit 130 performs a process of assigning IP addresses to its own device and to subordinate terminal devices connected via the LAN connection terminals 111, 113, 115, 117 and LAN ports 112, 114, 116, 118. The DHCP function unit 130 assigns IP addresses to its own device as necessary, and to subordinate terminal devices in response to requests from the subordinate terminal devices. As described above, the DHCP function unit 130 basically assigns IP addresses of the same segment (network section) to terminal devices connected to its own device, regardless of the LAN port to which they are connected.

[0039] However, the DHCP function unit 130 of the UTM device 1 in this embodiment assigns IP addresses of the same segment (network section) to terminal devices connected to the same LAN port. However, if the LAN port is different, IP addresses of different segments can be assigned. In addition, as described later, the DHCP function unit 130 can send a GARP (Gratuitous ARP) command to check for IP address duplication and, if there is a duplication, reassign the IP address.

[0040] FIG. 5 is a diagram for explaining an example of IP address assignment when the UTM device 1 has a plurality of LAN ports (four in this example). As shown in FIG. 4, the UTM device 1 of this embodiment has four LAN port units consisting of LAN connection terminals 111, 113, 115, and 117 and LAN ports 112, 114, 116, and 118. In this embodiment, the DHCP function unit 130 assigns an IP address of a different segment to each LAN port unit. In the example shown in FIG. 5, an IP address with a segment of "192.168.1" is assigned to a terminal device connected through the LAN connection terminal 111 and the LAN port 112. Also, an IP address with a segment of "192.168.10" is assigned to a terminal device connected through the LAN connection terminal 113 and the LAN port 114.

[0041] 5, an IP address with a segment of "192.168.50" is assigned to a terminal device connected via the LAN connection terminal 115 and LAN port 116. An IP address with a segment of "192.168.99" is assigned to a terminal device connected via the LAN connection terminal 117 and LAN port 118. In the UTM device 1 of this embodiment, among the IP addresses of each segment, an IP address with a host part of "1" is assigned to the UTM device 1.

[0042] It is assumed that "192.168.1.1", "192.168.10.1", "192.168.50.1", and "192.168.99.1" are assigned to the UTM device 1. This allows terminal devices connected through each LAN port to easily set the highest level belonging to the same network, in this example the UTM device 1, as the default GW. For this reason, communication between WAN-LAN and communication between LAN-LAN are cross-network communications (communications with destinations in different segments) and always take place via the UTM device 1, making it possible to utilize the advanced security functions provided by the UTM device 1.

[0043] The monitoring terminal identification unit 140 realizes a function of identifying a subordinate terminal device in which a predetermined event is occurring based on output signals from each unit constituting the security function unit 120, and requesting the DHCP function unit 130 to change the IP address of the identified terminal device. For example, the occurrence of a large amount of communication to a WAN can be detected by the P2P countermeasure unit 121 and the HP access control unit 122. That is, the P2P countermeasure unit 121 can detect that P2P (Peer to Peer) communication is frequent, and the HP access control unit 122 can detect that a web page is frequently accessed. Furthermore, the email countermeasure unit 124 can detect the receipt of a large amount of spam email. The HP access control unit 122 can detect frequent access to high-risk web pages.

[0044] When the P2P countermeasure unit 121 or the HP access control unit 122 detects the occurrence of a large amount of communication to the WAN, they notify the monitoring terminal identification unit 140 of that fact and information (e.g., MAC address) that identifies the terminal device, such as a subordinate PC, that is conducting the communication. This makes it possible to identify terminal devices that are conducting a large amount of communication to the WAN, terminal devices that are the recipients of a large amount of spam mail, and terminal devices that frequently access high-risk web pages.

[0045] Furthermore, when an event occurs in a terminal device connected to a LAN under the UTM device 1, such as reconnection to the LAN, use of an external memory such as a USB memory, or detection of an abnormality by security software, the terminal device notifies the UTM device 1. Such notification can be handled by installing software in advance in the terminal device connected to the UTM device 1 via the LAN, which notifies the UTM device 1 of the occurrence of the event. The notification is made to include information identifying the device itself (for example, a MAC address).

[0046] The terminal linking unit 127 monitors information from terminal devices connected to the LAN under the UTM device 1, and when it finds information notifying the occurrence of an abnormal event, it provides the notification to the monitoring terminal identification unit 140. This allows the monitoring terminal identification unit 140 to identify a terminal device in which an abnormal event has occurred, such as reconnection to the LAN, use of an external memory, or detection of an abnormality by security software. In this way, when the monitoring terminal identification unit 140 identifies a terminal device that should be particularly monitored, it requests the DHCP function unit 130 to reassign an IP address to the identified terminal device. In response to this, the DHCP function unit 130 reassigns an IP address to the identified terminal device that has a different segment (network portion) from the currently assigned IP address.

[0047] 6 is a diagram for explaining an example of reassignment of IP addresses when the UTM device 1 has multiple (four in this example) LAN ports. As explained using FIG. 5, the DHCP function unit 130 assigns IP addresses of different segments to the terminal devices connected to each LAN port unit. In this case, as explained using FIG. 2 and FIG. 3, it is assumed that PCs 3(1), 3(2), 3(3), 3(4), ..., which have been assigned IP addresses with the segment "192.168.1", are connected to the LAN port unit consisting of the LAN connection terminal 111 and the LAN port 112.

[0048] Here, as described with reference to FIG. 3, it is assumed that one or more of the above-mentioned predetermined events occur for PC3(2), which is a terminal device connected to the LAN port section consisting of the LAN connection terminal 111 and the LAN port 112 and has been assigned the IP address "192.168.1.3". In this case, the DHCP function unit 130 reassigns to PC3(3) an IP address of "192.168.2.2" in a segment different from the previous one, as shown in FIG. 3 and also in FIG. 6. In this case, the segment different from the previous one is reassigned an IP address of a segment that does not overlap with terminal devices connected to other LAN ports. In response to this, the DHCP function unit 130 also assigns to itself the IP address of the new segment, "192.168.2.1".

[0049] 6, basically, a terminal device with an IP address of the segment "192.168.1" exists in the LAN port section consisting of the LAN connection terminal 111 and the LAN port 112. However, by reassigning IP addresses, the LAN port section consisting of the LAN connection terminal 111 and the LAN port 112 will have a mixed state of terminal devices (PCs) with IP addresses of different segments.

[0050] In this case, consider communication between terminal devices in the same LAN connected to a LAN port section consisting of a LAN connection terminal 111 and a LAN port 112, for example, between PC3(2) and PC3(3) as described with reference to Fig. 3. As described above, the function of the SW hub 2 allows communication between terminal devices in different segments to be performed via the UTM device 1, which is the default GW.

[0051] For this reason, even in communications between terminal devices connected to the same LAN port, communications originating from PC3(2) and destination from PC3(2) which have different IP address segments must pass through the UTM device 1. In this case, safety can be ensured by using the security functions of the UTM device 1. Of course, communications between terminal devices in the same segment can be carried out via the SW hub 2 without passing through the UTM device 1, so there is no increase in communication traffic via the UTM device 1.

[0052] In order to enable such assignment and reassignment of IP addresses, as also shown in Fig. 4, the storage device 104 is provided with a host address management file 104A and a terminal address management file 104B. Fig. 7 is a diagram for explaining an example of a management mode of IP addresses in the UTM device 1, and shows examples of the host address management file 104A and the terminal address management file 104B.

[0053] As shown in Fig. 7(A), the own address management file 104A is configured to include a storage column for a LAN port ID, a storage column for a MAC address, and a storage column for an IP address. The LAN port ID is identification information for identifying a LAN port, and in this example, for ease of explanation, the reference symbols associated with each LAN port in Fig. 4 are used. The MAC address is the MAC address of the UTM device 1, and for ease of explanation, is written as "UTM device 1" in Fig. 7(A). The IP address is an IP address assigned in association with each LAN port.

[0054] As a result, in the case of the own device address management file 104A shown in FIG. 7A, it is possible to manage that two IP addresses "192.168.1.1" and "192.168.2.1" have been assigned to the own device (UTM device 1) in association with the LAN port 112. Therefore, it is possible to manage that two segments, "192.168.1" and "192.168.2", have been assigned in association with the LAN port 112. Similarly, in the case of the own device address management file 104A shown in FIG. 7A, it is possible to manage that an IP address "192.168.10.1" has been assigned to the own device (UTM device 1) in association with the LAN port 114. In other words, it is possible to manage that a segment, "192.168.10", has been assigned to the LAN port 114.

[0055] Similarly, in the case of the own device address management file 104A shown in Fig. 7(A), it is possible to manage that the IP address "192.168.50.1" has been assigned to the own device (UTM device 1) in association with the LAN port 116. That is, it is possible to manage that the segment has assigned "192.168.50" to the LAN port 116. Also, it is possible to manage that the IP address "192.168.99.1" has been assigned to the own device (UTM device 1) in association with the LAN port 118. That is, it is possible to manage that the segment has assigned "192.168.99" in association with the LAN port 114.

[0056] Furthermore, as shown in Fig. 7(B), the terminal address management file 104B is configured to include a storage column for a LAN port ID, a storage column for a MAC address, and a storage column for an IP address, similar to the case of the own device address management file 104A in Fig. 7(A). The LAN port ID is identification information for identifying a LAN port, and in this example, for ease of explanation, the reference symbols corresponding to each LAN port in Fig. 4 are used. The MAC address is the MAC address of a terminal device (PC) connected to the UTM device 1 via a LAN, and in Fig. 7(B), for ease of explanation, the MAC addresses are written as PC3(1), PC3(2), ... to distinguish each terminal device. Also, the IP address is an IP address given to each terminal device for each LAN port.

[0057] As a result, in the case of the terminal address management file 104B shown in Fig. 7(B), it can be managed that among the terminal devices connected to the LAN port 112, PC3(1), 3(3), 3(4), ... are assigned IP addresses with a segment of "192.168.1". Also, even among the terminal devices connected to the LAN port 112, it can be managed that an IP address with a segment of "192.168.2" is assigned to PC3(2). Specifically, it can be managed that PC3(1) is assigned the IP address "192.168.1.2", PC3(3) is assigned the IP address "192.168.1.4", PC3(4) is assigned the IP address "192.168.1.5", and PC3(2) is assigned the IP address "192.168.2.2".

[0058] 7(B), it can be managed that the IP address segment "192.168.10" is assigned to the terminal devices PC8(1), 8(2), ... connected to the LAN port 114. Specifically, it can be managed that the IP address "192.168.10.2" is assigned to PC8(1), and the IP address "192.168.10.3" is assigned to PC8(2).

[0059] In this way, the UTM device 1 can manage how IP addresses are assigned to itself and to the terminal devices (PCs) connected to each of the LAN ports 112, 114, 116, and 118 in association with each of the LAN ports 112, 114, 116, and 118. Therefore, the terminal device in which a specific event has occurred can be identified by its MAC address, and an IP address of a different segment can be reassigned to the terminal device so that it does not overlap with an IP address already assigned. In addition, an IP address of the same segment as the reassigned IP address is additionally assigned to itself, so that the UTM device 1 can easily and reliably become the default GW for the terminal device to which the IP address has been reassigned.

[0060] [Summary of the processes performed by UTM devices] FIG. 8 is a sequence diagram for explaining the processing mainly performed by the UTM device 1. The example shown in FIG. 8 is also an example in which PC3(1), PC3(2), PC3(3), PC3(4), ... are connected to the UTM device 1 via the LAN connection terminal 111 and the LAN port 112, as in the case explained using FIG. 3 and the like. The example shown in FIG. 8 is also an example in which one or more of the above-mentioned predetermined events occur for PC3(2), and an IP address is reassigned to PC3(2), and communication is performed with PC3(3) connected to the same LAN4. For this reason, descriptions of PC3(1) and PC3(4), which are not the main participants of communication in this example, are omitted to simplify the explanation.

[0061] As described with reference to FIG. 2 and the like, in this example, the UTM device 1 and the terminal device connected to the LAN port 112 are assigned IP addresses with a segment of "192.168.1". Specifically, the UTM device 1 is assigned the IP address "192.168.1.1", PC3(2) is assigned the IP address "192.168.1.3", and PC3(3) is assigned the IP address "192.168.1.3". In this case, it is assumed that each unit of the security function unit 120 of the UTM device 1 functions and detects the occurrence of one or more of the above-mentioned predetermined events for PC3(2) (step S1). As described above, the predetermined events are the occurrence of a large amount of communication to the WAN, the receipt of a large amount of spam mail, frequent access to high-risk web pages, reconnection to the LAN, use of an external memory, and detection of an abnormality by security software.

[0062] In this case, it is assumed that the monitoring terminal identification unit 140 of the UTM device 1 functions and identifies PC3(2) as the device in which a specific event has occurred. In this case, the monitoring terminal identification unit 140 requests the DHCP function unit 130 to reassign an IP address to PC3(2). The DHCP function unit 130 uses a GARP command to check whether a duplicate IP address has been assigned to PC3(2) (step S2). This check is simply a check as to whether the IP address "192.168.1.3" that has already been assigned to PC3(2) can be reassigned to PC3(2).

[0063] Since the IP address "192.168.1.3" has already been assigned to PC3(2), PC3(2) notifies the UTM device 1 that there is a duplication, in other words, sends a request to acquire a different IP address (step S3). In response, the DHCP function unit 130 of the UTM device 1 refers to the own address management file 104A and the terminal address management file 104B in the storage device 104, and assigns an unused IP address in another segment to PC3(2) (step S4). In this way, the process of step S4 is a process of re-assigning an IP address in a different segment to PC3(2), which has already been assigned an IP address.

[0064] By the process of step S4, "192.168.2.2" is assigned to PC3(2) as an IP address of a segment different from the current IP address, and the device with the IP address "192·168.2.1" is set as the default GW. Furthermore, the DHCP function unit 130 of the UTM device 1 assigns the second IP address "192.168.2.1" to the LAN port 112 of the device itself (step S5).

[0065] By the processing of steps S1 to S5, all subsequent communications from PC3(2) will always pass through the UTM device 1, even if the communications are directed to a terminal device (PC) connected to the same LAN4 (step S6). Of course, communications from other terminal devices to PC3(2) will also always pass through the UTM device 1. As described above, the SW hub 2 is provided so that communications to destinations with IP addresses in different segments will be performed via the UTM device 1, which is the default GW. Note that communications between PC3(1), PC3(3), and PC3(4), which are terminal devices connected to LAN4 and have IP addresses in the same segment, can be performed through the SW hub 2 because they are in the same segment. Therefore, there is no increase in communication traffic via the UTM device 1.

[0066] [Effects of the embodiment] The UTM device 1 of the above-described embodiment can reassign an IP address in a different segment from other terminal devices to a terminal device connected to itself via the SW hub 2 when a predetermined event occurs, such as the occurrence of a large amount of communication to the WAN. This makes it possible to ensure that communication with a terminal device assigned an IP address in a different segment is performed via the UTM device 1. In this case, communication with a terminal device assigned an IP address in a different segment can be checked using the security function of the UTM device 1, thereby improving safety. In other words, even if a terminal device is connected to the UTM device 1 (communication between terminal devices subordinate to the UTM device 1), communication with a problematic terminal device as a source or destination can be performed with high safety using the security function of the UTM device 1.

[0067] [Variations] In the above embodiment, when a specific event occurs or occurs in a subordinate terminal device connected to the UTM device 1 via a LAN, an IP address in a segment different from that of other terminal devices is reassigned. The specific event in this case is not limited to a large amount of communication to the WAN, receipt of a large amount of spam mail, frequent access to high-risk web pages, reconnection to the LAN, use of an external memory, detection of an abnormality by security software, etc. For example, sending a large amount of e-mail, remaining access to a specific recipient or web page for a long period of time, etc. can be added to the specific event. In other words, various events that can be detected as risky events can be included in the specific event.

[0068] In the above embodiment, the terminal device connectable to the UTM device 1 via a LAN has been described as a PC (Personal Computer), but the present invention is not limited to this. The terminal device may be a communication terminal such as a tablet terminal or a smartphone that is wirelessly connected via an access point connected to the LAN.

[0069] In the above embodiment, the security management device according to the present invention is provided to a UTM device having a plurality of different security functions, but the present invention is not limited to this. The present invention can be applied to a device to which a plurality of terminal devices are connected via a LAN and which has one or more security functions capable of detecting at least one or more predetermined events.

[0070] As described above, when a terminal device is assigned an IP address in a segment different from other terminal devices (terminal device separated into a different segment) due to the occurrence of a specific event, data cannot be sent from the original IP address. However, even if a terminal device where a specific event has occurred is a destination rather than a source, it may be better to enable communication.

[0071] Therefore, in the UTM device 1, just as an IP address is added to the device itself (UTM device 1), the IP addresses already assigned to the terminal devices under the control are left as they are, and an IP address in a segment different from that of the other terminal devices is added and managed. This management can be performed by using the terminal address management file 104B. In this case, the UTM device 1 is provided with a function for automatically adding a routing setting such that, when transmission data arrives with the original IP address as the destination, the transmission data is transferred to a terminal device separated in a different segment. This makes it possible to handle cases where data is sent using the original IP address.

[0072] That is, the reassignment of an IP address to a terminal device (PC) may be performed by deleting the already assigned IP address and reassigning a new IP address, or by leaving the already assigned IP address as is and additionally assigning a new IP address. The manner in which the IP address is reassigned can be selected according to the system settings.

[0073] In the above embodiment, a LAN is formed by connecting terminal devices through the SW hub 2. In this case, the number of SW hubs is not limited to one, and the present invention can also be applied to a case where a LAN is formed by connecting another SW hub to another SW hub.

[0074] In the above embodiment, a LAN is configured using a SW hub, but the present invention is not limited to this. Instead of a SW hub, a so-called repeater hub can be used. In this case, the repeater hub only needs to transmit to the default GW transmissions from and receptions to a terminal device having an IP address in a different segment from the IP address originally assigned to the terminal device under the UTM device 1.

[0075] In the above embodiment, the UTM device 1 has been described as having a plurality of LAN ports 112, 114, 116, and 118, and assigning IP addresses of different segments to terminal devices connected to each LAN port. In this way, even if a specific event does not occur, communication between terminal devices connected to the UTM device 1 can always involve the UTM device 1 for communication across LAN ports. In this case, the security of communication between terminal devices connected to the UTM device 1 can be improved. However, this is not limited to this.

[0076] As described above, even if the UTM device 1 has multiple LAN ports, it can assign IP addresses of the same segment to terminal devices connected to the device itself. Even in this case, an IP address of a different segment is assigned to a terminal device in which a specific event is occurring or in which a specific event has occurred. This makes it possible for communications between terminal devices connected to the UTM device 1 to be conducted via the UTM device 1 only when the source or destination of the communications is a terminal device assigned an IP address of a different segment. This reduces the amount of communication traffic conducted via the UTM device 1, and can improve the security of communications between terminal devices connected to the UTM device 1 while reducing the load on the UTM device 1.

[0077] In the above embodiment, the so-called subnet mask is "255.255.255.0", but this is not limited to this. If the subnet mask is "255.255.0.0", the first two bits separated by "." (period) become the network part (segment), but the present invention can be applied even in this case.

[0078] [others] As can be seen from the above description of the embodiment, the function of the address assignment means of the security management device in the claims is realized by the DHCP function unit 130 of the UTM device 1 in the embodiment. Also, the function of the security means of the security management device in the claims is realized by the various units of the security function unit 120 of the UTM device 1. Also, the function of the identification means of the security management device in the claims is realized by the monitoring terminal identification unit 140 of the UTM device 1. [Explanation of symbols]

[0079] 1...UTM device, 101...connection terminal, 102...communication I / F, 103...control unit, 104...storage device, 104A...own device address management file, 104B...terminal address management file, 105...clock circuit, 111, 113, 115, 117...LAN connection terminal, 112, 114, 116, 118...LAN port, 121...P2P countermeasure unit, 122...HP access control unit, 123...virus countermeasure unit, 124...email countermeasure unit, 125...IPS / IDS unit, 126...firewall unit, 127...terminal linkage unit, 130...DHCP function unit, 140...monitoring terminal identification unit, 2...SW hub, 3(1), 3(2), 3(3), 3(4)...PC, 4...LAN, 5...Internet, 6...HTTP server device, 7...email server device

Claims

1. A security management device that realizes a security function regarding communication between different segments, address assignment means for assigning an IP (Internet Protocol) address of the same segment to each of the subordinate terminal devices; A security means for realizing a security function; a specifying means for specifying, based on an output signal from the security means, a terminal device to be monitored among the subordinate terminal devices; Equipped with the address assignment means assigns, to the terminal device identified by the identification means, an IP address in a segment different from that of other terminal devices under the control of the terminal device; When the address assignment means assigns an IP address to the terminal device identified by the identification means, the address assignment means additionally assigns to itself an IP address of the same segment as the IP address assigned to the identified terminal device. A security management device comprising:

2. A security management device as claimed in claim 1, The security measures include at least one of security measures related to peer-to-peer communication, security measures related to homepage access, security measures related to computer viruses, security measures related to e-mail, security measures related to inappropriate intrusion, and security measures related to communications that should not be allowed to pass. A security management device comprising:

3. A security management device according to claim 1 or claim 2, The security means includes a terminal linking means for detecting a terminal device that may be problematic based on information from the terminal device connected to the LAN port. A security management device comprising:

Images